Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/filebrowser/filebrowser/v2 | go | < 2.33.7 | 2.33.7 |
| github.com/filebrowser/filebrowser | go | <= 1.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2025-52900, stems from the filebrowser application not setting explicit file permissions when creating files, which includes the application's database and any user-uploaded content. This results in files being created with default system permissions, which are often world-readable (e.g., 0644). An attacker with local access to the server could therefore read sensitive data from any file created by the application.
The analysis of the fixing commit ca86f9162166216620365c0f81629c0934ce02574d76 confirms this. The patch introduces two main changes:
Stricter Permission Constants: In files/file.go, the constants for file and directory permissions were changed from world-readable (PermFile = 0644, PermDir = 0755) to user/group-only readable (PermFile = 0640, PermDir = 0750).
Explicit Database Permissions: In cmd/utils.go, the python function, which handles the database initialization, was modified to use the new, more secure file permission constant when creating the database file. The call to storm.Open was updated to explicitly pass files.PermFile.
This pinpoints the cmd.python function as a key vulnerable function because it was directly responsible for creating the sensitive database file with insecure permissions. While other functions that handle file uploads were also vulnerable due to the use of the old permission constants, the python function is the one explicitly shown being fixed in the provided patch, making it a high-confidence indicator for this vulnerability.
